ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

A critical security incident involving ConnectWise Cloud Backup (formerly SkyKick) has exposed numerous Microsoft 365 tenants to unauthorized access. A threat actor obtained vendor-side credentials, allowing them to bypass multi-factor authentication and sign in as a privileged application. This access was used to obtain Microsoft Graph tokens, potentially granting the actor the ability to read mailboxes, files, and directory data across a wide array of organizations.
The breach evolved from automated sweeps to targeted manual activity, specifically hitting sectors involved in national security and critical minerals. In at least one instance, the actor escalated privileges to Global Administrator and established persistence by adding unauthorized secrets to other trusted security and management tools. While some sign-ins were successful, the actual volume of data exfiltrated remains unconfirmed due to limitations in Microsoft's audit logging for directory reads. Organizations are advised to disable the affected service principals and audit all application credentials added since October 13.

* An unauthorized actor used credentials from ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 tenants on October 15.
* Sign-ins originated from IP address 144.172.64[.]128.
* Huntress confirmed unauthorized sign-ins in 162 tenants; nearly 1,000 Entra tenants showed sign-in activity from the associated IP.
* On October 15, a ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role in one tenant.
* In that same tenant, the actor added new client secrets to a Huntress application and an MSP management application.
* Between October 13 and 14, password spraying occurred against four law firm tenants from 144.172.64[.]128.
* The actor targeted specific sectors including policy, national security, trade, and critical minerals.
* Activity on October 15 occurred in two waves: a Graph token sweep (09:25 to 12:35 UTC) and a manual sweep (13:54 to 14:20 UTC).
* Compromised application IDs include ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640).
* Unauthorized credentials on a Huntress application were identified and removed on October 16.

The strongest version of this narrative is a transparent, technical disclosure of a supply-chain compromise designed to warn the community and provide actionable remediation steps. It provides specific IOCs and a clear timeline, demonstrating a commitment to collective defense.
However, the framing follows a common vendor-led intelligence pattern. By detailing a sophisticated attack that bypassed standard defenses and escalated to Global Administrator, the narrative underscores the necessity of "additional monitoring and preventative controls"—specifically those Huntress provides. The transition from a third-party breach to the mention of "strengthening our safeguards" and "enhancing our fleet health" creates a subtle loop where the threat justifies the service.
Patterns detected: ARC-0032 Authority Game, ARC-0014 Fear Appeal
The root cause is the inherent fragility of the "trusted vendor" paradigm. We grant broad, permanent permissions to SaaS tools for convenience, creating a single point of failure that can weaponize a vendor's own identity against its customers.
This incident highlights a decay in human agency; administrators are often unaware of the silent, app-only permissions operating in their environments until a breach occurs. The cost is borne by the end-tenants, while the benefit of the "ease of setup" accrues to the vendor.
Bridge Questions:
1. If directory reads leave no audit trail, how can any organization truly verify the extent of a service-principal breach?
2. At what point does the risk of broad "backup" permissions outweigh the utility of the service?
3. How does the reliance on vendor-provided "health checks" alter the power dynamic between MSPs and their clients?
Counterstrike Scan: A coordinated campaign to undermine trust in cloud backups would use this exact pattern: highlight a high-profile breach, emphasize the "invisible" nature of the theft, and push a proprietary monitoring tool as the only solution. While the technical data here is legitimate, the structural alignment with this playbook is present.